Open p0lr opened 3 years ago
Thanks! cc @TomSellers
I dug into this a bit this morning. The data in the *.cpe23
fields is indeed CPE 2.3 but it is in the URI format. Jon called this out when he added CPE in PR #172
The 2.3 specification has 3 formats:
URI format, intended to be backwards compatible with 2.2 (Section 6.1 in the ref below)
cpe:/a:hp:insight_diagnostics:7.4.0.1570:-:~~online~win2003~x64~
Formatted String (Section 6.2 in the ref below)
cpe:2.3:a:hp:insight_diagnostics:7.4.0.1570:-:*:*:online:win2003:x64:*
WFN - well formatted name (Section 5 in the ref below)
wfn:[
part="a",
vendor="hp",
product="insight_diagnostics",
version="7\.4\.0\.1570",
update=NA,
sw_edition="online",
target_sw="win2003",
target_hw="x64"
]
We are currently emitting the URI variant as our cpe23
value. I can likely add a new field named cpe23_fs
that is more in line with what folks expect. Here's a rough explanation of the values.
part:vendor:product:version:update:edition:sw_edition:target_sw:target_hw:language:other
^ ^ ^ ^ ^
| | | | ---- x86, JVM, CLR, etc.
| | | |
| | | --- valid OS or software env
| | |
| | --- how tailored to market / class of users
| |
| --- deprecated in formatted string format
|
--- update, service pack, point release - vendor specific
Also, there are a couple things we are likely doing incorrectly.
CPE 2.3 as 4 new fields (sw_edition
, target_sw
, target_hw
, language
) that don't exist in 2.2. In order to express them in a backwards compatible way they are "packed" into the edition
field (deprecated in 2.3) separated by the tilde ~
character.
We have't been providing these new fields when we know them. We also haven't been consistently handling the update
field which comes after the version.
The URI format also introduced percent encoding for certain characters. We're almost certainly doing that incorrectly or incompletely.
Proposal:
cpe23_fs
field to contain the 2.3 formatted string formatsw_edition
, target_sw
, target_hw
, language
) in both the URI and formatted string output.Thoughts @p0lr @hdm ?
Reference:
Do we also want to deprecate the cpe23 field? Any reason to leave it this way instead of perhaps removing it later and, if kept, making a distinct cpe23_22compat field with its contents?
CPE is tagged as 2.3, but is in 2.2 format.
To Reproduce
Would recommend changing this to a 2.2 tag, or update the CPE to 2.3